For packet format reference use http://www.networksorcery.com/enp/protocol/hsrp.htm . This rule fires off when the state of the conversation is "4", which implies (but does not necessarily prove) that the owner of the virtual ip has changed or is about to change.